Vendors / Unity Records 4 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 0
CVSS high 3
Exploited now Unity records in CISA KEV No Unity vulnerabilities are listed in CISA KEV.
Components Products in the NVD configurations · select one to filter the records Priority HIGH 72
Unity Runtime before 2025-10-02 on Android, Windows, macOS, and Linux allows argument injection that can result in loading of library code from an unintended location.
CVSS 3.1 HIGH 8.4· Local · No auth · No interaction · EPSS 0.00644 · Published 2025-10-03 · Fixed in 6000.3.0b4, 6000.2.6f2 +19 CWE-88
Priority LOW 38
An Incorrect Use of Privileged APIs vulnerability in Unity Parsec on Windows hosts leads to a potential Elevation of Privilege.
CVSS 3.1 HIGH 8.4· Local · No auth · No interaction · EPSS 0.00185 · Published 2026-07-04 · No fix listed CWE-648
Priority LOW 33
Unity Parsec has a TOCTOU race condition that permits local attackers to escalate privileges to SYSTEM if Parsec was installed in "Per User" mode.
CVSS 3.1 HIGH 7.0· Local · Low privileges · No interaction · EPSS 0.003 · Published 2023-08-20 · No fix listed CWE-367
Priority LOW 30
The Unity Web Player plugin before 4.6.6f2 and 5.x before 5.0.3f2 allows attackers to read messages or access online services via a victim's credentials
CVSS 3.0 MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00875 · Published 2019-07-29 · No fix listed CWE-200
Open these records in search → All records by CVSS severity
0 3 1 0 0
THREATIST.IORead the docs